- cypherpunks-legacy - lists.cpunks.org

Re: Smartcards are coming to the US
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"shamrock(a)netcom.com" 21-APR-1996 21:08:17.34 >At 15:15 4/21/96, Brad Dolan wrote: >>Saw a CNN story Friday about an interesting special debit card >>application in Mexico. They're being issued to poor Mexicans, who can >>use them to buy tortillas and a few other foodstuffs. The cards are tied to >>a behavior-control database and failure to send kids to school, get >>mandatory medical exams/treatments/vaccinations, etc. results in card >>deactivation. >My first response was: he is making this up. But it shoudn't come as a >surprise to any reader of this list. Expect to see more of it. Ever read _The Bell Curve_? -Allen

1 0

Re: reference
by Bob Roberts 17 Dec '03

17 Dec '03

Dave Emery wrote: > > > I'll bite, how ? Crypto is not a destructive weapon - it may > blind the opponent, perhaps even sometimes at critical times when that > can induce him to behave dangerously - but I fail to see how a cipher in > and of itself is a weapon of destruction, let alone mass destruction. I > see crypto as an entirely defensive weapon with no potential to destroy > anything (except perhaps data when the key gets lost or forgotten). Imagine in the new realm of white collar crime, individuals are only convicted because of evidence. Evidence that can't be decrypted cannot be used. I see that going back to defense, but on the wrong side.

1 0

DCSB: Gold Denominated Burmese Opium Futures?
by Robert Hettinga 17 Dec '03

17 Dec '03

Notice the *corrected* reservation deadline of May 4th, 1996, and the meeting day of Monday instead of the usual Tuesday... -RAH -----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston (Formerly The Boston Society for Digital Commerce) Presents Perry E. Metzger "Possible Futures: The Impact of Ubiquitous High Speed Networking on Intermediation and Regulation" or "With Spring Street Brewing shares trading on the web, are gold denominated Burmese opium futures inevitable?" *Monday*, May 6, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Perry Metzger is the President of Piermont Information Systems Inc., a consulting firm specializing in communications and computer systems security. He has worked for, or consulted to, the New York financial community for most of the last decade. He has been strongly involved with the Internet Engineering Task Force's security area for some time, and is the author of several security related RFCs. He is also the co-chair of the IETF's Simple Public Key Infrastructure working group, which is developing public key cryptographic standards for the internet. Networking technology is racing far ahead of culture. Fiber optics offer the possibility of cheap truly ubiquitous internet service in the tens of gigabits per second within the decade, and cheap high speed mobile connectivity is also likely. We will likely live in a world where anyone can sit in a park with a cheap laptop and communicate over a multi-megabit per second channel to any other civilized location on the planet. This development may radically change our culture, and with it the nature of regulation and intermediation in the marketplace. Although opium futures trading might not be inevitable, the scope of the trends we are facing should not be underestimated. Mr. Metzger will discuss these and similar developments; he will also discuss the limits to our ability to predict or alter the course such changes will take. This meeting of the Digital Commerce Society of Boston will be held on *Monday*, May 6, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have a jacket and tie dress code. Please note that this meeting is on *Monday* this month, due to a scheduling problem at the Harvard Club. We go back to meeting on the first Tuesday of the month in June. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, May 4, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for the following few months are: June Dan Shutzer FSTC July Pete Loshin Author, "Electronic Commerce" August Duane Hewitt Idea Futures We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMYUw3PgyLN8bw6ZVAQGhqQQAkO9V9nCDK728Wbi6/niEWlViu8Lg6SKA EuxUJYUxPSF1IQJ1v9PRs1R22+BdsROrTnYhunpwbz/keuYW1qMotnzfvwpgsI57 GEHWl5lefbTfo3v+11RZsjFUHaWTCUYLC5b3j1VwfclkWgw7iK89ou29lAIWNoZh Er9ggqU8FDg= =IeSs -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: Cell Kill 2
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

It's all just an elaborate plot to help discourage cell-phone cloning. Ryan

1 0

Re: trusting the processor chip
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:13 AM 4/27/96 -0800, Norman Hardy wrote: >At 9:53 AM 4/25/96, Jeffrey C. Flynn wrote: >.... >> >>It looks like I may have no other option than to give some processor some >>degree of trust. Which processor I should choose, and why that one? >.... >In the days of microcode this was my best (worst?) scenario. Setting up for >fast divide has been an art long before Pentium divide fame. In microcode >you don't spend time testing for cases that you can prove won't happen. >Some obscure cases can arise only with a rare combinations of two 48 bit >operands. The microcode flaw would be to put the processor into privileged >mode even while getting the right answer. There would plausible deniability >even if the flaw were discovered. (Gosh, I didn't test for this fall thru >case because here is the proof that it can't happen.) Of course there is a >bug in the proof but no one reads proofs. This can now be exploited by >anyone that knows what division leaves the machine in privileged state. > >This is an attack on those systems that are rated to run untrusted machine >code, using privileged mode code to limit the operation of the untrusted >code. > >Only one person is necessary to pull this off. He must be trusted to >produce microcode and the implementer of the divide algorithm. Test code >will not find the transition to privileged code just because you can't test >the whole machine state after every tested instruction. Normally the bogus >privileged state of the machine will quickly expire (on the next interrupt) >and will cause no permanent state change even in those few cases where a >magic division occurs naturally. There are some limits to the extent of this kind of problem. If the hardware/OS you are using provides a completely disjoint memory map based on the privileged mode state, it may be hard to exploit the ability to switch to privileged mode. With maps which allow access to the user's address space while in privileged mode (e.g. Solaris), it may be possible to just keep running, and so complete a successful attack. On the other hand, with most systems I have seen, setting yourself into privileged state will persist thru the next interrupt. The system Norm and I worked on would detect it later. (It checked every 5 minutes or so.) The IBM operating systems I have used would not detect, or correct this change. The ray of hope in this area is that there are so many other easier attacks on modern systems. People will have a tendency to use them first. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

[Pointer] fight-censorship-discuss
by Rich Graves 17 Dec '03

17 Dec '03

FYI. -rich "Have you no decency, sir?" To: majordomo(a)c2.org Subject: ignored info fight-censorship-discuss

1 0

Additional drive/stego/tempest/customs NOIZE
by Michael Motyka 17 Dec '03

17 Dec '03

Dear Sir, Sunder Wrote: > You seem to think these guys are actually super spies, not clueless > overpaid (for their level of skills) bored burrowcrats working on an > assembly line. You're over estimating their abilities by at least > four orders of magnitude there. > Through the *magic* of taxation and government contracts the opponents you are so casually dismissing as dull-witted drones are your peers. So unless you really are smarter than everyone else I would say that your above statement is rash. If the motivation to snoop is strong enough the resources will be put into place by the current crop of ground-dwelling representatives and any imaginable technology could be applied to the *problem*. I doubt in this case, at this time, that the motivation is enough to pay for a database of EMI analyses of PC bootups. Mike I found this one interesting: http://www.jya.com/fbi-en7898.htm Our elected representatives probably believe this official-looking analysis more than they do mere citizen's opinions. I have LOTS of copper materials. I have a source for conductive paints. Could you suggest a good source for ferrites in powder and tile form? All this to insure my privacy whilst I compute in my own house! The snoopers have, by their very existence, a chilling effect on speech.

1 0

Re: Smartcards are coming to the US
by btmoore＠iquest.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 06:00 PM 4/20/96 -0700, Lucky Green wrote: >Years after smartcards have become ubiquitous in such countries as Pakistan >and Nepal, not to mention Europe, I just saw my first smartcard commercial >ever on US television. > >Way to go :-) > > > >Disclaimer: My opinions are my own, not those of my employer, DigiCash, Inc. > >-- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. Hummm... Did you ever wonder *why* this was introduced to the "third-world" countries first? If you've been following the progress of the so called "smart- card," you will have noticed it was first introduced to areas that are extremely "low-tech" and well off the beaten path. Also the areas it was *first* introduced were generally marked by a high population density. Notice, "low-tech," high population density and in locations that are definitely out of the loop when it comes to news coverage. There was obviously a strategy involved and I think it would be prudent to wonder why. The U.S. is one of the most technologically advanced nations on the face of the earth. The citizenry are very familiar with technology and are quite adept in it's uses. Not to mention the fact that some of the worlds pivotal financial markets are located here, it makes one wonder why they didn't introduce the card here. I for one am not nearly so intrigued with the benefits of these "smart cards." I see too much room for mischief. Already, where I live, there are Insurance com- panies that have access to the data bases of grocery stores in this area. If one uses one's "debit card" to purchase groceries... and say, purchases a carton of cigarettes for a loved one or friend, the insurance company has access to that information. There is a growing collection of information being gathered on every- one in this country. Although it appears to be harmless, using sophisticated collation and analysis techniques, the accuracy of the inferences *I* believe constitute an invasion of privacy and a clear and present danger. Consider a scheme used by local law enforcement here several years ago. They set up an operation with the several horticulture stores. Anyone purchasing "grow lights" was noted, their license plates were copied and later... based on the fact, a person purchased a "grow light" a search warrant was issued for the search of their homes. Although grow lights are used all the time for legitimate purposes it was assumed that anyone purchasing one was growing marijuana. Imagine being awakened at 6:00 am by a team of narcotics officers with dogs and a warrant allowing them to search your premises. Given the current asset forfeiture laws, and given that well over 75% of the money supply by government studies has been contaminated with cocaine, you could lose your home if the dogs happen to "hit" on any money in your home. Never mind you're not one who grows or deals in narcotics, this is extremely dangerous! In the new anti-terrorism bill recently signed, the FBI has been given the ability to tap 1 out of 10 phone lines without the need to actually come out and set up a tap on your line. This will now be handled automatically for them by your friendly phone company. I see "smart cards" as one more twist in the ever tightening noose around our necks and the Bill of Rights. Not only will the cards be able to keep your complete history from cradle to the grave on them, but what's to prevent them from being used in the future as an internal passport of sorts? We are rapidly approaching the point where we will be stopped and required to produce our papers. This information will be readily available to any government agency... and not a few corporations to exploit at will. No I'm not at all enthused with the advent of the smart card. Currently there is much discussion regarding various banking institutions charging excessive amounts for transaction fees at your local "ATM." Wonder how much they will be looking to charge for this service? Something to think about. Benjamin T. Moore, Jr. (btmoore(a)iquest.net) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMYT0c4SAJOVFNaChAQG6kAf/SF/cMlbkj+0FQCBjHe29wJR93UMBqykf Fz0N9dUB+TLksddhcEMWzwY0oDGjT87DOjYmimzvDQgwinxQEemxe4pS2ph2ydJZ 3iELOWRcyKdD4Hi+RB2O9gjKNR6M1O2I/cvdnxjV6r+L9Ysd1ea35jJ2R7LhVVMf MRQQuMs3zx5zJafp2LNI43JCGvWweHy0ZEzHex65Ee9FdRTLNT5KIbl/QHaFP6Ij gMWysxBnj3bBCoBx0l511GMmPN0W/tycec45EvRFhJOUPR+H0bKhzoYs46tSQAkr NPPTFCdvFae539xgWlvVpIffp/mGigsjaKv7WJRu4hEpQeRV9lNGmA== =GGwf -----END PGP SIGNATURE----- --------------------------------------------------------------------------------------------------------------- "When they came for the Fourth Amendment I didn't say anything because I had nothing to hide. When they came for the Second Amendment I didn't say anything because I wasn't a gun owner. When they came for the Fifth and Sixth Amendments I didn't say anything because I had committed no crimes. When they came for the First Amendment I couldn't say anything." -------------------------------------------------------------------------------------------------------------- PGP Key available from key servers, or on request. Key Fingerprint = 3D 90 0C 58 EE 65 AE 89 28 C5 58 A2 D5 F4 A8 --------------------------------------------------------------------------------------------------------------

5 4

Re: Bank transactions on Internet
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"watt(a)sware.com" "Charles Watt" 16-APR-1996 13:06:06.52 >First, the U.S. banking system is very nice to account holders. The banks, >rather than the customers, assume all risk associated with security problems >in telephone banking, ATMs, etc... Internet banking is no different, which >explains why so few banks have jumped onto the net with real transactions. >If an SFNB customer should lose any funds due to a security problem, SFNB >pays, not the customer. That would depend on whether the customer can prove a security problem, because otherwise you're going to get a lot of con artists making a lot of money off of you. >Second, in order to break the SSL-protected password of an SFNB account >holder, you need access to the encrypted data. This is not easy to obtain >over the Internet, and would generally require illegal activity in order >to gain control of a host within the Internet infrastructure or collusion >with the account holder. Should an attacker crack the key and obtain >the account number and password of an SFNB account holder, they are clearly >warned upon login that they are engaging in illegal activity. Once they One, ever heard of a packet sniffer? If the account holder is on an Intranet, then someone within it could easily get such information. Two, somehow I suspect that the penalties for computer breakins are significantly less than those for bank fraud/grand theft; they aren't going to matter if you're willing to take the risk. >have logged in, there is no way to transfer money out of the account >without leaving a target address and phone number for the recipient. >Furthermore, any payment to an individual or unknown entity would be >made in the form of a physical check that would have to be cashed at >a physical bank. The whole process is heavily audited with real-time >audit filtering and pattern matching capabilities -- SFNB is, afterall, >running on a military grade secure operating system (see SWP at >www.secureware.com) Any security system that is deployed should be >compared against the value you are trying to protect. It seems like a >pretty big risk to an attacker -- and I assure you SFNB will prosecute. Target address and phone number? Make fake ID, get yourself a PO box and a telephone forwarding/answering service (giving the PO box as the address), then target it there. Use the fake ID at a check-cashing place. You can make the fake ID in whatever name you want, which makes it easier. >Finally, I whole-heartedly agree that 40-bit encryption is far too weak >for many applications, and that the current export limitations are absurd. I'm glad you realize that. I've edited out what look to be improvements, which I hope for your stockholders' sake you've implemented. -Allen

1 0

Re: Freedom and security
by Scott Schryvers 17 Dec '03

17 Dec '03

At 11:08 PM 4/28/96 -0700, you wrote: > >>No. "Those who sacrifice security for freedom, will have neither" is >>not consistent with Franklin's statement, nor is it true. Security and >>freedom are antithetical, and worse than that, security is always an >>illusion. But you can have your illusion, as long as you keep it out of >>my life. Censor yourself if you wish, but don't censor anything I might >>want to look up. >> >The Internet may once have been one of those small close knit communities, >small enough not to require law enforcement - although even then it had >rules that had to be followed. But that Internet is gone, and it will >never return, because now its the biggest city in the world, and the >history of the change from pastoral communities to urban life, to the >development of nation states and power blocs is also the history of crime. >And as the Internet grows, so will its security problems. > >My position is to seek a balance between the freedom of the individual and >the security of the community. My argument is that when the security of >the community is threatened by the freedom of the individual, the community >will always prioritise its safety. "When the security of the community is threatened by the freedom of the individual?!" >From what socio-political ideology do you run your group? >Good government of course means >maintaining individual freedoms *and* maintaining community security. I >actually disagree that they are antithetical. On the contrary they are a >balance that any society has to find. Where individual freedom takes over >you have the urban jungle where predators consume prey. Where security >takes over you have the totalitarian state. Neither is necessary nor >inevitable. By the way government serves best when it serves least. Remember that. >We are simply concentrating on the problem from two different angles. My >concern is to maximise community safety while protecting individual >freedom. Your angle is to maximise individual freedom while protecting >community safety. There is IMHO very little difference between the two. No there is a major difference, I feel society is served best when each individual has the freedom to defend and protect themselves apposed to what you want us to do in essence you want us to lay down those liberties to an outsied group who are supposed to protect us. The internet is not a city, it is a computer network that spans the globe. What you are asking for in analogy is not a cop walking a city street but fucking U.N. tanks driving through neiborhoods enforcing rights by way of brute force. >From what I have seen of what your group does you are as hypicritical as law enforcement in your techniques and attacks on others. Often unwarranted and justified in the name of some supposed higher ideal. PGP encrypted mail preferred. Scott J. Schryvers <schryver(a)radiks.net> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzFX9usAAAEH/2r2eovPAoYZbxzmfJ1DW7yjjdVnckXjUVKU/zZNAUV/IjzF GDEq040wbAG1rFHDYoBOjjJTOGWMFuZ9apqoAvvI7Q4NAmVrNif0Rp8q/j4jib13 dlAA4Q0nvJZ5YNw4sf4r0iug76+9i0WpIZoP60DEB8BTuyCP55+nsbe7Ii3xLRyq ThZ2fhNqK2hD/rFugXK29Ynyzuc6TuFfu78kVOsYUUbQpplXyaLjhGKN94pZ5jox x7/wvqmBoH9E3rnaIPY9vOwy3kvMmCTlkjhlCzMXZHDn0e3UHWAax2mUTMttRzzi +SUv45h6ua+eSwUkA8uojojn/JiPOKIPwPk3hq0ABRG0KFNjb3R0IEouIFNjaHJ5 dmVycyA8c2Nocnl2ZXJAcmFkaWtzLm5ldD4= =58dK -----END PGP PUBLIC KEY BLOCK-----

1 0